This is an automated email from the git hooks/post-receive script.

Git pushed a commit to branch release/4.4
in repository ffmpeg.

commit 9fd68baff0de460f6c54bf5a46547f5d92427112
Author:     James Almer <[email protected]>
AuthorDate: Tue Mar 3 18:36:17 2026 -0300
Commit:     Michael Niedermayer <[email protected]>
CommitDate: Tue May 5 18:55:07 2026 +0200

    avcodec/av1dec: sync frame header and tile group behavior with CBS
    
    A new Sequence Header or a Temporal Delimiter OBU invalidate any previous 
frame
    if not yet complete (As is the case of missing Tile Groups).
    Similarly, a new Frame Header invalidates any onging Tile Group parsing.
    
    Fixes: out of array access
    Fixes: av1dec_tile_desync.mp4
    Fixes: av1dec_tile_desync_bypass.mp4
    
    Signed-off-by: James Almer <[email protected]>
    (cherry picked from commit a1496ced654e7dca9a426d263d35f9c39b7b4b88)
    Signed-off-by: Michael Niedermayer <[email protected]>
---
 libavcodec/av1dec.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/libavcodec/av1dec.c b/libavcodec/av1dec.c
index d04bc55883..d6974a43a4 100644
--- a/libavcodec/av1dec.c
+++ b/libavcodec/av1dec.c
@@ -1017,6 +1017,8 @@ static int av1_decode_frame(AVCodecContext *avctx, void 
*frame,
             }
 
             s->raw_seq = &obu->obu.sequence_header;
+            s->raw_frame_header = NULL;
+            raw_tile_group      = NULL;
 
             ret = set_context_with_sequence(avctx, s->raw_seq);
             if (ret < 0) {
@@ -1066,6 +1068,8 @@ static int av1_decode_frame(AVCodecContext *avctx, void 
*frame,
                 goto end;
             }
 
+            raw_tile_group      = NULL;
+
             if (unit->type == AV1_OBU_FRAME)
                 s->raw_frame_header = &obu->obu.frame.header;
             else
@@ -1144,8 +1148,11 @@ static int av1_decode_frame(AVCodecContext *avctx, void 
*frame,
                 }
             }
             break;
-        case AV1_OBU_TILE_LIST:
         case AV1_OBU_TEMPORAL_DELIMITER:
+            s->raw_frame_header = NULL;
+            raw_tile_group      = NULL;
+        // fall-through
+        case AV1_OBU_TILE_LIST:
         case AV1_OBU_PADDING:
         case AV1_OBU_METADATA:
             break;

_______________________________________________
ffmpeg-cvslog mailing list -- [email protected]
To unsubscribe send an email to [email protected]

Reply via email to